There is a slight annoyance with O365 with how to enable mailbox auditing for all mailboxes. Setting mailbox auditing is required as by default mailbox auditing in O365 isn’t turned on by default, and as such will not appear in the search results when you search the O365 audit log for mailbox activity. I also like to do this, as it counts towards the secure score within O365!

It would be really nice if Microsoft could allow this to be turned on at a tenancy level so that it could filter down to every new mailbox as it gets created – but Microsoft being Microsoft requires an O365 administrator to turn it on for each individual mailbox. Now, this isn’t too difficult as long as you are OK with PowerShell! I have created a script, which will basically enable Mailbox Auditing for those mailboxes that do not have it turned on. It would log out to the screen the number of mailboxes requiring to be auditing enabled, and the name of the mailbox.